Remote SSH access via internet

j.v. mentions some good points you should also consider.

a static ip isn't necessary, though it's convenient.

what i do most of the time for client servers is the following:

- use hosts.deny to deny all for ssh
- use hosts.allow to allow just ssh access from a few known-safe hostnames (home, office)
- disable password logins
- allow key authentication
- (when possible) change the listening port

with all of those, you should be relatively safe. as j.v. suggests, you can also tunnel 5900 over ssh to further secure your access.

You would need to add the file to the /etc/ folder, it then kicks into action automatically. Other useful files that may reside there are hosts.deny and hosts.equiv

It's important to block holes because hackers find an open machine and flood the ports from every direction trying to break in. Plug the holes and they soon give up and you find your internet a whole lot faster.

You really need to examine your secure.log to see who is trying to break into your server, and what usernames they are trying.

mine looks like this:

sshd: ALL

then, you add the services, hosts, domains, IPs, or subnets for which you want to allow access in hosts.allow.

If you and only you are connecting from known ISPs, there is really no reason to explicitly deny access from certain IPs. If you had a pool of users who used various ISPs, you may find it useful to block known attackers.

A good idea is to set yourself a "back door" of a known server you SSH to. If you ever find yourself locked out of your server, you can SSH from a known machine to set the hosts.allow to let yourself in.

I have never needed to use hosts.equiv, but I believe it lists trusted hostnames. Try to not get to complex unless your security needs it.


My allowed connections look like this:

{quote:title=j.v. wrote}Personally, I really like tunneling everything through ssh because I gain comfort knowing that most eavesdroppers can't glean any intelligence from any intercepted traffic, and because I like public key authentication, which you can do with ssh, way better than username/password authentication; the former I believe to be way superior in preventing break-ins.{quote}

Here's another vote for turning off pasword authentication:
http://www.cpanel.net/security/notes/randomjstoolkit.html
A new exploit is going around that uses password authentication even when using non-standard ssh ports. Strong passwords are broken with no sign of brute force. They believe a database of root passwords has been compromised. To make a long story short:
systems with password authentication off have not been affected

--
Cole